AML/CTF compliance begins with client verification and screening — and under FATF's Recommendations, any business classified as high-risk must screen clients at onboarding for PEP, RCA, and sanctions exposure. A robust screening programme combines two related but distinct checks working together.
What's the difference between PEP screening and sanctions screening?
PEP screening evaluates whether a customer holds, or has held, a prominent public function — heads of state or government, senior politicians, senior government, judicial, or military officials, senior executives of state-owned corporations, or high-ranking political party officials — and assigns a risk score that drives ongoing due diligence. Sanctions screening is a specialised search against national and global databases to identify individuals, entities, or countries prohibited from certain business activities or transactions, aimed at curbing illegal activity, terrorism financing, weapons proliferation, and other national security threats. Checks are run against databases maintained by the UN, national regulators, and law enforcement agencies.
Why does screening risk vary by business?
As a regulated business, your risk assessment has to weigh geography, industry, the nature of the business itself, the type of clients involved, the country of transaction and operation, transaction size and pattern, and the overall shape of the business relationship. High-risk industries named consistently across regulators include financial institutions, real estate agencies, money service businesses, cryptocurrency exchanges, legal professionals, and accounting firms — sectors where a single relationship can carry outsized exposure if screening isn't done properly.
What do PEP and sanctions requirements actually look like across major jurisdictions?
In the US, the PATRIOT Act's customer identification programme (CIP) and CDD obligations make PEP and sanctions screening compulsory — covering senior foreign political figures, their immediate family, known associates, and beneficial owners, checked against OFAC's Specially Designated Nationals (SDN) list plus related lists such as the Foreign Sanctions Evaders List. Any US-registered or operating business is prohibited from dealing with sanctioned persons or accounts at all. In Canada, FINTRAC requires PEP and sanctions checks at the start of a business relationship, covering both foreign and domestic PEPs and their close associates, with enhanced due diligence and mandatory source-of-funds verification for identified PEPs, checked against lists maintained by the Office of the Superintendent of Financial Institutions. In the EU, KYC checks at onboarding must cover PEPs, sanctioned or high-risk countries, and beneficial ownership, with enhanced due diligence required for PEPs or customers from high-risk third countries. In the UK, the definition of "obliged entities" extends beyond financial institutions to tax professionals, virtual currency providers, and art dealers, with digital identity verification and automated screening recommended at onboarding.
What should a business look for in a screening solution?
The same four questions matter regardless of jurisdiction: does the database's scope cover PEPs, families, associates, and relevant government watchlists; how does the tool handle filtering of matches to reduce false positives; how frequently is it updated; and which specific sources and lists does the provider actually draw from. Screening built well on these fronts lets a business document its compliance clearly, support internal audits through case management, and apply appropriately different scrutiny to domestic versus foreign PEPs rather than treating every match identically.
